
CLAIMS 



What is claimed is: 



r ^l^> 1 . A method for detecting fraud when facilitating a payment transaction over a 
2 ^global wide area network, the mefliod comprising: 



3 
4 
5 
6 



receiving a sale informmion; 

receiving a paymentymformation from a buyer; 

analyzing a transaction information for fraud; and 

if the analyzing/ndicates fraud, communicating an enhanced transaction information to 



7 k a human for fraud analysis. 

2. The method of Claim 1 wherein the sale intimation is received from a seller, 
the method further comprises: 

communicating an invoice to a buyer./ 




1 3 . The method of Claim 1 whereinyuie sale information is received from the buyer, 

2 and the method further comprises: 

3 communicating a sale confirmation request to the seller. 



1 
2 



4 . The method of Claim / further comprising: 
performing simple screening of the transaction information. 



1 5 . The method ofyClaim 4 wherein performing simple screening comprises at least 

2 one of: 

3 determining whether a financial account specified as part of the payment information is 

4 on a list of known fraudulent financial account numbers; 
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5 determining whether the name of the buyer or tlie name of the seller is on a list of 

6 known fraudulent users; / 

7 determining whether a shipping address specified as part of the payment information is 

8 on a list of known fraudulent addresses; / 

9 determining whether a billing address specified as part of the payment information is on 

10 a list of known fraudulent addresses; / 

11 determining whether a billing address specified as part of the payment information is on 

12 a list of known fraudulent addresses; / 

13 determining whether an email address of the buyer or the seller is on a list of known 

14 fraudulent email addresses; and / 

15 determining whether an Internet protocol (IP) address of the buyer or the seller is on a 

16 list of known fraudulent IP addresses. 

1 6. The method of Claim 1 further comprising: 

2 seeking approval fronva financial institution based on the payment information. 

1 7 . The method of Claim 6 wherein seeking approval comprises: 

2 sending a requestor approval that comprises at least an account information extracted 

3 from the payment information and an amount information to a financial institution; 

4 receiving from the financial institution a response to the request; 

5 rejecting the payrrient transaction or continuing with the payment transaction responsive to the 

6 response. / 

V \ 

4>^9^> 8. The method o^Claim 1 wherein analyzing comprises: 

2 s performing rule-based analyses. 
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9. The method of Claim 8 wherein perforating rule-based analyses comprises: 
applying a plurality of rules to the transaction information such that a score for the 

payment transaction is incremented when one of tpe rules is violated. 

10. The method of Claim 9 wherein performing rule-based analyses comprises 
further comprises : / 

creating the enhanced/transaction information if the score exceeds a predefined 
threshold such that the enhanced transaction information comprises a tracking number, the 
score, and a violated rule information. 

1 1 . The method of Claim 9 wherein ap^ying comprises: 

incrementing the score responsive to a numeric value assigned to the rule violated. 

12. The method of Claim 9 Wherein the plurality of rules comprise at least one of a 
plurality of suspect data rules and plurality of velocity rules. 

13. The method of Claim 12 wherein the plurality of suspect data rules comprise at 
least some of: / 

comparison of /shipping address with a directory of known real addresses; 

comparison pi a shipping address with a list of addresses implicated in prior possibly 
fraudulent transactions; 

comparison of a billing address with a directory of known real addresses; 

comparison of a billing address with a list of addresses implicated in prior possibly 
fraudulent fransactions. 
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1 14. The method of Claim 12 wherein the plurality of velocity rules comprise at least 

2 some of: / 

3 determining whether a first number of transactions/involving the seller exceeds a first 

4 predefined threshold for a first predefined time period; / 

5 determining whether a second number of transactions involving the buyer exceeds a 

6 second predefined threshold for a second predefined time period; 

7 determining whether a first total dollar amount for a first plurality of transactions 

8 involving the buyer exceeds a third predefined^ threshold for a third predefined time period; 

9 determining whether a second total efollar amount for a second plurality of transactions 

0 involving the seller exceeds a fourth predefined threshold for a fourth predefined time period; 

11 determining whether a third total dollar amount for a specified financial account exceeds 

12 a fifth predefined threshold for a fiftlVpredefined time period; 

13 determining whether a thirmiumber of transactions involving the specified financial 

14 account exceeds a sixth predefined threshold for a sixth predefined time period. 

1 15. The method off Claim 12 wherein the plurality of velocity rules comprise at least 

2 some of: I 

3 determining whemer a financial account specified as part of the payment information 

4 has exceeded a predetermined acceptable number of times used over a predetermined period of 

5 time; / 

6 determining whether a financial account specified as part of the payment information 

7 has exceeded a predetermined acceptable number of times used over a predetermined number of 

8 transactions witn the seller; 

9 determining whether a financial account specified as part of the payment information 

10 has exceeded a predetermined acceptable number of times used over a predetermined number of 

1 1 transactions with a payment facilitator system. 
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1 16. The method of Claim 1 wherein communicating an enhanced transaction 

2 information comprises sending an email pessage to at least one of a plurality of human fraud 

3 investigators. 

1 17. The method of Clainyl further comprising: 

2 if the analyzing indicates fraud, notifying the buyer and/or a seller that the payment 

3 transaction is on hold pending the outcome of a fraud investigation. 



1 
2 



18. The method of Claim 17 wherein notifying comprises: 
sending an email message to the buyer and/or the seller. 



1 
2 
3 
4 



19. 



8 
9 
10 
11 
12 
13 



A system comprising: 

a first computer supporting communications over a wide area network by a 



buyer; 



seller; 



a second computer supporting 



executing software that facilitates a payment 
that the third computer 



communications over the wide are network by a 



a third computer supporting communications over the wide are network and 



t -ansaction between the buyer and the seller such 



analyzes the payment transaction for fraud by applying a plurality of 
rules and incrementing a score Apr the payment transaction for each of the 
plurality of rules that is violated and 

if the score exceeds a pre defined threshold, communicates an 
information about the payment transaction to a human fraud investigator. 
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1 20. The system of Claim 19 further/comprising: 

2 a fourth computer capable of communications with the third computer and allowing the 

3 human fraud investigator to communicate with the third computer. 

1 21. The system of Claim 20 wtterein the third computer is coupled to the fourth 

2 computer via a dedicated communications line. 

1 22. The system of Claim 20 wherein the third computer communicates with the 

2 fourth computer over the wide area network. 

1 23 . The system of Claim 19 further comprising: 

2 a fifth computer capable of communications with the third computer and responding on 

3 behalf of a financial institution to k request for authorization of the payment transaction initiated 

4 by the software executing on thef third computer. 

1 24. The system of ulaim 23 wherein the third computer is coupled to the fifth 

2 computer via a dedicated communications line. 

1 25 . The system of Claim 23 wherein the third computer communicates with the fifth 

2 computer over the wide area network. 

1 26. The systemfof Claim 19 wherein the wide area network is the Internet. 

^jMf^^ 27. A machine readable medium having stored thereon instructions which when 
2 /^executed by a processor caup the machine to perform operations comprising: 

3 receiving a sale information; 
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4 receiving a payment information from a buyer; 

5 analyzing a transaction information for fraud; and 

6 if the analyzing indicates fraud, communicating an enhanced transaction information to 

7 a human for fraud anal/sis. 

1 28. The machine readable medium of Claim 27 wherein the instructions cause the 

2 machine to perform operations further comprising: 

3 performing simple screening of ttie transaction information. 

1 29 . The machine readablmnedium of Claim 28 wherein performing simple 

2 screening comprises at least one of:/ 

3 determining whether a financial account specified as part of the payment information is 

4 on a list of known fraudulent financial account numbers; 

5 determining whether the name of the buyer or the name of the seller is on a list of 

6 known fraudulent users; / 

7 determining whethe/ a shipping address specified as part of the payment information is 

8 on a list of known fraudulent addresses; 

9 determining whether a billing address specified as part of the payment information is on 

10 a list of known fraudulent addresses; 

11 determining wnether a billing address specified as part of the payment information is on 

12 a list of known fraudulent addresses; 

13 determining whether an email address of the buyer or the seller is on a list of known 

14 fraudulent email addresses; and 

15 determining whether an Internet protocol (IP) address of the buyer or the seller is on a 

16 list of known fraudulent IP addresses. 
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1 30. The machine readable medium of Claim 27 wherein the instructions cause the 

2 machine to perform operations further comprising: 

3 seeking approval from a financial institution based on the payment information. 

1 31. The marline readable medium of Claim 30 wherein seeking approval 

2 comprises: / 

3 sending a request for approval that comprises at least an account information extracted 

4 from the payment information and an amount information to a financial institution; 

5 receiving from the financial institution a response to the request; 

6 rejecting tMe payment transaction or continuing with the payment transaction responsive to the 

7 response/ 



32. The machind readable medium of Claim 27 wherein analyzing comprises: 
performing rule-lfased analyses. 



1 33. The machine readable medium of Claim 32 wherein performing rule-based 

2 analyses comprises: / 

3 applying a plurality of rules toohe transaction information such that a score for the 
payment transaction is incremented^when one of the rules is violated. 

1 34. The machine readable medium of Claim 33 wherein performing rule-based 

2 analyses further comprises: / 

3 creating the enhanced transaction information if the score exceeds a predefined 

4 threshold such that the enhanced transaction information comprises a tracking number, the 

5 score, and a violated yule information. 
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1 35. The machine readable medium of Claim 33 wherein applying comprises: 

2 incrementing the score responsive to a numeric value assigned to the rule violated. 

1 36. The machine readable medium of Claim 33 wherein the plurality of rules 

2 comprise at least one of a plurality of suspect data rales and a plurality of velocity rules. 

1 37 . The machine readable medium of Claim 27 wherein communicating an 

2 enhanced transaction information comprises sliding an email message to at least one of a 

3 plurality of human fraud investigators. / 

1 38. The machine readable medium of Claim 27 wherein the instructions cause the 

2 machine to perform operations further comprising: 

3 if the analyzing indicates fraud/ notifying the buyer and/or a seller that the payment 

4 transaction is on hold pending the outcome of a fraud investigation. 

1 39. The machine readable medium of Claim 38 wherein notifying comprises: 

2 sending an email message to the buyer and/or the seller. 
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